services:
  frontend:
    build:
      context: .
      dockerfile: Dockerfile
      # All VITE_*_APP_URL build args default to relative paths (see
      # Dockerfile) so the browser only ever calls this same origin; nginx
      # proxies each prefix to BACKEND_URL server-side. Only override one
      # here if that specific service is reachable on the public internet
      # on its own.
      #
      # If you tunnel this container and need SSO login to work for outside
      # users, VITE_AUTH_URL must be baked in at build time as the actual
      # public tunnel URL (it becomes the OAuth redirect_uri sent to the
      # identity provider) — uncomment and set it:
      # args:
      #   VITE_AUTH_URL: https://your-tunnel-domain.example
    container_name: digitaltwin_frontend_v2
    restart: unless-stopped
    ports:
      # Tunnel THIS host port to the public internet — never expose the
      # backend port directly. nginx inside the container proxies API calls
      # to BACKEND_URL server-side, so the backend itself stays local.
      - "${FRONTEND_PORT:-8081}:80"
    environment:
      # Where nginx forwards proxied API calls. Must be reachable FROM
      # inside this container:
      #   - a LAN IP (default below, matches the current local backend)
      #   - host.docker.internal, if the backend runs on this same Docker
      #     host (enabled via extra_hosts below)
      BACKEND_URL: ${BACKEND_URL:-http://192.168.1.82:8000}
      # IRCFA is served by a separate backend host.
      BACKEND_URL_IRCFA: ${BACKEND_URL_IRCFA:-http://192.168.1.119:8000}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/health"]
      interval: 30s
      timeout: 5s
      retries: 5